Certificate matching method and device, equipment, storage medium and program product

Abstract

The invention relates to the technical field of Internet, and discloses a certificate matching method, device and equipment, a storage medium and a program product, and the method comprises the steps: monitoring an access request initiated by a client; analyzing the access request, and determining a domain name parameter carried in the access request; obtaining a plurality of pre-configured certificates, and selecting a target certificate matched with the domain name parameter from the plurality of pre-configured certificates; and performing handshake connection with the client by using the target certificate. By implementing the technical scheme of the disclosure, a corresponding relationship between a domain name and a certificate does not need to be set on the load balancer, dynamic matching of the certificate based on the real-time access request is realized, complex security requirements are better adapted, the dynamic adjustment capability of the load balancer is improved, and the user experience is improved. And the processing efficiency and security of the load balancer on the high-concurrency requests are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and in particular to a certificate matching method, device, equipment, storage medium and program product. Background Art

[0002] With the rapid development of the Internet, the number and complexity of network applications and services are increasing. In order to ensure the service quality under high concurrent requests, load balancers that provide load balancing are widely used in various network architectures. At present, each domain name of the load balancer corresponds to a server block, and each server block uses a fixed certificate. This makes it difficult to dynamically adjust the certificate selection and loading process according to the real-time network environment and security requirements when processing access requests, affecting the efficiency and security of the load balancer for high concurrent requests. Summary of the invention

[0003] In view of this, the present disclosure provides a certificate matching method, apparatus, device, storage medium and program product to solve the problem that it is difficult for a load balancer to dynamically select a certificate.

[0004] In a first aspect, the present disclosure provides a certificate matching method, including: monitoring an access request initiated by a client; parsing the access request to determine a domain name parameter carried in the access request; obtaining multiple pre-configured certificates, and selecting a target certificate that matches the domain name parameter from the multiple pre-configured certificates; and using the target certificate to perform a handshake connection with the client.

[0005] In a second aspect, the present disclosure provides a certificate matching device, including: a request monitoring module, used to monitor access requests initiated by a client; a request parsing module, used to parse the access requests and determine the domain name parameters carried in the access requests; a certificate matching module, used to obtain multiple pre-configured certificates, and select a target certificate that matches the domain name parameters from the multiple pre-configured certificates; a connection module, used to use the target certificate to perform a handshake connection with the client.

[0006] In a third aspect, the present disclosure provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the certificate matching method of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0007] In a fourth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the certificate matching method of the first aspect or any corresponding embodiment thereof.

[0008] In a fifth aspect, the present disclosure provides a computer program product, including computer instructions, which are used to enable a computer to execute the certificate matching method of the above-mentioned first aspect or any corresponding embodiment thereof.

[0009] The certificate matching method, device, equipment, storage medium and program product provided by the present disclosure deploy multiple pre-configured certificates in the load balancer. When an access request initiated by a client is monitored, the domain name parameter of the access request is matched with the domain name information in the pre-configured certificate, the target certificate corresponding to the access request is determined from the pre-configured certificate, and the target certificate is used for handshake connection. Therefore, there is no need to set the corresponding relationship between the domain name and the certificate on the load balancer, and dynamic matching of certificates based on real-time access requests is realized, which is more adaptable to complex security requirements, improves the dynamic adjustment capability of the load balancer, and improves the processing efficiency and security of the load balancer for high concurrent requests. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the specific embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0011] Figure 1 is a schematic diagram of the correspondence between the domain name and the certificate in the embodiment of the present disclosure;

[0012] Figure 2 is a flowchart of a certificate matching method according to an embodiment of the present disclosure;

[0013] Figure 3 is a schematic diagram of a process for establishing a connection between a client and a load balancer according to an embodiment of the present disclosure;

[0014] Figure 4 is a flowchart of another certificate matching method according to an embodiment of the present disclosure;

[0015] Figure 5 is a structural block diagram of a certificate matching device according to an embodiment of the present disclosure;

[0016] Figure 6 It is a schematic diagram of the hardware structure of the computer device of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0018] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0019] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0020] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0021] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0022] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0023] In modern deployment environments, hybrid deployment and containerization technologies are becoming increasingly popular. In related technologies, when using a load balancer to load balance high-concurrency requests, a server block is pre-assigned to each domain name, and each server block uses a fixed certificate. This method has many defects when processing high-concurrency access requests (such as HTTPS type access requests), which are specifically manifested in the following aspects:

[0024] (1) Each domain name needs to manage its corresponding certificate separately. When the number of domain names is large, the workload of certificate management and maintenance is huge, resulting in complex certificate management.

[0025] (2) Each server block uses a fixed certificate and cannot dynamically select a certificate based on the different requirements of client requests. This makes it difficult to adapt to complex security requirements, resulting in insufficient flexibility of the certificate.

[0026] (3) In the scenario of high concurrent requests, each request needs to go through a fixed certificate selection and loading process, which increases the delay in request processing and the system load.

[0027] (4) It is difficult to dynamically adjust the certificate selection strategy according to the real-time network environment and security requirements, and it is impossible to respond to changes in a timely manner and lacks dynamic adjustment capabilities.

[0028] (5) A group of backend services usually deploy different applications, and it is difficult for a server block to meet the needs with only one certificate, which increases the complexity of hybrid deployment.

[0029] (6) Containerization technology requires that load balancers can be deployed and expanded quickly. The existing certificate management methods are difficult to adapt to the dynamic changes of the containerized environment, resulting in poor compatibility with the containerized environment.

[0030] The current relationship between the application layer load balancer's certificate and domain name is as follows Figure 1 As shown in the figure, when a user accesses an application through a client, the load balancer can monitor the access request, find the corresponding certificate based on the domain name of the access request, and then use the certificate to establish a secure connection with the client that initiated the access request. Since one domain name can only correspond to one certificate, this cannot meet the dual certificate support of ECC certificates and RSA certificates, and limits the client to only one certificate. In addition, the relationship between the domain name and the certificate needs to be maintained manually. Changes to the domain name and updates to the certificate require manual addition or modification. If multiple domain names use the same certificate, many corresponding relationships need to be added.

[0031] Based on this, the embodiment of the present disclosure pre-configures multiple certificates on the load balancer, and dynamically selects the optimal certificate for handshake connection based on the access request monitored. There is no need to manually manage the correspondence between domain names and certificates, which improves the dynamic adjustment capability of the load balancer and improves the processing efficiency and security of the load balancer for high-concurrency requests.

[0032] According to an embodiment of the present disclosure, an embodiment of a certificate matching method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] In this embodiment, a certificate matching method is provided, which can be used in computer devices, such as computers, servers, etc. A load balancer is deployed in the computer device, and the load balancer is used to match the corresponding certificate for the client's access request. Figure 2 is a flow chart of a certificate matching method according to an embodiment of the present disclosure, such as Figure 2 As shown, the process includes the following steps:

[0034] Step S101: monitor access requests initiated by the client.

[0035] An access request is a request for an application resource initiated by a user to a load balancer through a client (such as a web browser, mobile application, or other network client), that is, a request initiated by a client to connect to a load balancer. The load balancer listens for network connections on a specified port. When a client initiates an access request to the load balancer, the load balancer can listen for the access request initiated by the client on the specified port.

[0036] Specifically, the access request may be defined by the HTTP / HTTPS protocol, and may include a GET request for accessing a web page, a POST request for creating or updating a resource, a PUT request for updating a service resource, etc. The type of the access request is not specifically limited here.

[0037] In a specific example, an access request may include a request line, a request header, and a request body. The request line includes a request method (such as GET method or POST method), a request URL (such as / index.html), and an HTTP version (such as HTTP / 1.1); the request header includes metadata about the access request, such as Host, User-Agent, Accept, etc.; and the request body includes data sent to the load balancer.

[0038] Step S102: parse the access request and determine the domain name parameters carried in the access request.

[0039] The domain name parameter is used to represent the domain name of the server that the client requests to connect to. Specifically, the domain name parameter may include the protocol, domain name, path, and query string. Take a specific link https: / / www.example.com / path / to / resource?query=123 as an example, where "https: / / " is the protocol; "www.example.com" is the domain name; " / path / to / resource" is the path, and "?query=123" is the query string.

[0040] After listening to the access request initiated by the client, the load balancer parses the access request content to find the field containing the domain name, and determines the domain name pointed to by the access request through the value of the field. Specifically, the various fields contained in the access request are parsed to determine whether there is a server name field (i.e., servername) in the access request. If there is a servername field in the access request, the value of the servername field is read, and the domain name pointed to by the access request is determined based on the value of the servername field. In a specific example, in an access request of the HTTP protocol, the server name servername can be located at the position of the request URL, that is, before the request path of the access request, usually after http: / / or https: / / ; the server name servername can also be located in the Host field of the request header, and the server name servername is specified in the Host field.

[0041] If the servername field does not exist in the request, the load balancer will further search the Host field in the access request and determine the domain name to which the access request points based on the value of the Host field. If the Host field in the access request does not exist either, the load balancer will point the access request to the default domain name.

[0042] Step S103: Acquire multiple pre-configured certificates, and select a target certificate that matches the domain name parameter from the multiple pre-configured certificates.

[0043] Pre-configured certificates are available certificates pre-configured in the load balancer. Certificates are used to build a secure path between the client and the load balancer. Specifically, the load balancer provides a certificate configuration interface, where technicians can pre-configure the domain names supported by each certificate. One certificate can be configured with multiple domain names, and the same domain name can also be configured in multiple certificates.

[0044] The domain name parameter includes the domain name pointed to by the access request. The domain name in the domain name parameter is matched with the domain names supported by each pre-configured certificate to determine one or more pre-configured certificates that match the domain name parameter. If there is only one pre-configured certificate that matches the domain name parameter, the pre-configured certificate is determined as the target certificate; if there are multiple pre-configured certificates that match the domain name parameter, the multiple pre-configured certificates that are matched are sorted from the dimensions of secret key, validity period, signature, etc., and the best pre-configured certificate is selected as the target certificate.

[0045] Step S104: Use the target certificate to perform a handshake connection with the client.

[0046] Use the target certificate to use the SSL / TLS protocol to encrypt communications between the client and the load balancer. Figure 3 As shown, the target certificate and the private key corresponding to the target certificate are loaded in the load balancer. When the client attempts to establish a connection with the load balancer, the client initiates a TCP connection of an access request to the specified port corresponding to the load balancer (for example, port 443 for HTTPS); after the access request is connected to the specified port, the client sends a ClientHello message, which contains information such as the supported SSL / TLS version, encryption algorithm, and compression method; when the load balancer receives the ClientHello message, it sends a ServerHello message in response to the ClientHello message to the client, which contains the selected SSL / TLS version, encryption algorithm and compression method, as well as the public key of the load balancer. At the same time, the load balancer sends the target certificate, which contains the public key and certificate chain of the load balancer; the client uses the built-in certificate authority list to verify the target certificate of the load balancer. If the target certificate is verified and the target certificate is valid, the client will continue the handshake process. If the target certificate is invalid, the client may disconnect; the client uses the public key and random number of the load balancer to generate a pre-master key; the client sends a change encryption rule message and a completion message containing the hash of the pre-master key; the load balancer responds to the change encryption rule message and the completion message to confirm the change of the encryption rule; after the completion message is confirmed by both parties, the SSL / TLS handshake is completed, and an encrypted connection will be established between the client and the load balancer to form a secure channel. The client can send access request data to the load balancer through the secure channel, and the load balancer can respond to the access request and return the requested resource corresponding to the access request to the client.

[0047] The certificate matching method provided in this embodiment deploys multiple pre-configured certificates in the load balancer. When an access request initiated by a client is monitored, the domain name parameter of the access request is matched with the domain name information in the pre-configured certificate, the target certificate corresponding to the access request is determined from the pre-configured certificate, and the target certificate is used for handshake connection. As a result, there is no need to set the corresponding relationship between the domain name and the certificate on the load balancer, and dynamic matching of certificates based on real-time access requests is achieved, which is more adaptable to complex security requirements, improves the dynamic adjustment capability of the load balancer, and improves the processing efficiency and security of the load balancer for high concurrent requests.

[0048] In this embodiment, a certificate matching method is provided, which can be used in computer devices, such as computers, servers, etc. A load balancer is deployed in the computer device, and the load balancer is used to match the corresponding certificate for the client's access request. Figure 4is a flow chart of a certificate matching method according to an embodiment of the present disclosure, such as Figure 4 As shown, the process includes the following steps:

[0049] Step S201: monitor the access request initiated by the client. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0050] Step S202: parse the access request and determine the domain name parameters carried in the access request. Figure 2 Step S102 of the illustrated embodiment will not be described in detail here.

[0051] Step S203: Acquire multiple pre-configured certificates, and select a target certificate that matches the domain name parameter from the multiple pre-configured certificates.

[0052] Specifically, the above step S203 includes:

[0053] Step S2031, in response to the domain name configuration operation for each certificate, determining the domain name information corresponding to each certificate.

[0054] The domain name information is the domain name supported by the certificate and the generalized domain name corresponding to the domain name. The domain name configuration operation is to configure the domain name supported by the certificate. Figure 3 As shown, the load balancer provides a control interface for configuring the domain name of the certificate. The technician can configure the available certificates in the control interface according to the actual usage requirements. When configuring the domain name of the certificate, the load balancer can respond to the technician's domain name configuration operation for each certificate and determine the domain name information supported by each certificate.

[0055] Step S2032, fill the domain name information into the domain name field of the certificate to generate a corresponding pre-configured certificate.

[0056] When generating a certificate, you can use the certificate encryption tool provided by the certificate authority to generate a corresponding private key file for each certificate, and use the private key file and certificate encryption tool to create a certificate signing request to display the field information required for certificate generation, such as the country code, state, city, organization, and organizational unit. At this time, extract the domain name field from the field information required for the certificate, fill in the information for each domain name field according to the domain name information, complete the issuance of the pre-configured certificate, and store the issued pre-configured certificate in the certificate cache pool corresponding to the load balancer, such as Figure 3 shown.

[0057] Step S2033: parse the requested domain name corresponding to the domain name parameter, match the requested domain name with the domain name information in each pre-configured certificate, and select multiple candidate certificates corresponding to the requested domain name from the multiple pre-configured certificates.

[0058] A candidate certificate is an available certificate selected from multiple preconfigured certificates for handshake between the client and the load balancer. As described above, the domain name parameter carries the requested domain name to which the access request points. Since the certificate corresponding to the requested domain name is not pre-bound, it is dynamically matched based on the real-time access request. After the load balancer receives the access request, it parses the domain name parameter in the access request to determine the requested domain name to which the access request points. Then, the requested domain name is matched with the domain name information in each preconfigured certificate to generate a domain name matching result corresponding to the requested domain name. One or more preconfigured certificates that match the requested domain name contained in the domain name matching result are determined as candidate certificates.

[0059] Step S2034: Based on the attribute information of the candidate certificates, a target certificate matching the requested domain name is determined from multiple candidate certificates.

[0060] The attribute information is the certificate-specific attributes of the candidate certificate, such as the length of the certificate's secret key, the validity period of the certificate, etc. The candidate certificates are sorted in multiple dimensions based on the attribute information of the candidate certificates to obtain a candidate certificate sorting list. The candidate certificate sorting list is used to select the best certificate from the multiple candidate certificates, and the best certificate is determined as the target certificate that matches the requested domain name.

[0061] In some optional implementations, the above step S2034 includes:

[0062] Step a1, sorting multiple candidate certificates based on attribute information of the candidate certificates to obtain a certificate sorting result.

[0063] Step a2: based on the certificate sorting result, a target certificate is selected from multiple candidate certificates.

[0064] According to the attribute information of the candidate certificates, the candidate certificates are sorted from multiple dimensions of the attribute information to obtain the sorting results corresponding to each attribute. Combined with the importance of each attribute, a corresponding weight value can be matched for each attribute, and the weight value is used to comprehensively sort each sorting result to obtain the final certificate sorting result.

[0065] According to the certificate sorting result, the ranking information of each candidate certificate can be determined, and the optimal candidate certificate can be determined using the ranking information, and the optimal candidate certificate can be determined as the target certificate.

[0066] By sorting according to the attribute information of the certificates, it is helpful to select the best certificate for handshake connection according to the sorting result, thereby ensuring the processing efficiency and security of the access request.

[0067] In some optional implementations, the attribute information includes one or more of the key length, algorithm type, and validity period. The key length is the length of the key generated by the certificate, the algorithm type is the type of encryption algorithm used by the certificate, and the validity period is the time until the certificate expires. Accordingly, the above step a1 includes:

[0068] Step a11, sorting the candidate certificates according to the key length to obtain a first sorting result.

[0069] Step a12, sorting the candidate certificates according to the algorithm type to obtain a second sorting result.

[0070] Step a13, sorting the candidate certificates according to the validity period to obtain a third sorting result.

[0071] Step a14, integrating the first sorting result, the second sorting result and the third sorting result to generate a certificate sorting result.

[0072] The longer the key length of the candidate certificate, the higher the ranking. Sort by key length to get the first ranking result of the candidate certificate under the key length dimension.

[0073] The reliability of the encryption algorithm of the certificate can be determined by combining the algorithm type. The more reliable the encryption algorithm of the candidate certificate is, the higher the ranking is. Sorting by algorithm type can obtain the second ranking result of the candidate certificate under the algorithm type dimension.

[0074] The longer the validity period of the candidate certificate, the higher the ranking. Sorting by validity period, the third ranking result of the candidate certificates under the validity period dimension is obtained.

[0075] According to the importance of key length, algorithm type and validity period to the certificate, the first sorting result, the second sorting result and the third sorting result are merged to obtain the certificate sorting results of the candidate certificates in multiple dimensions.

[0076] By combining multiple attributes in the attribute information for multi-dimensional sorting, an optimized sorting of candidate certificates is achieved, thereby being able to determine the best certificate that matches the access request according to the multi-dimensional sorting result.

[0077] In an optional implementation, when storing the pre-configured certificates, the load balancer may sort the pre-configured certificates in combination with the attribute information of the pre-configured certificates to obtain a certificate list, and load the certificate list into the certificate cache pool, such as Figure 3 After the candidate certificates are determined, the candidate certificate ranking list can be determined according to the certificate list, so there is no need to sort the candidate certificates, and the optimal certificate can be directly determined, which saves the matching time of the optimal certificate and improves the matching efficiency.

[0078] Of course, the sorting dimension can also be adjusted according to the attribute information of the candidate certificates to update the candidate certificate sorting list to ensure the matching degree between the optimal certificate and the requested domain name.

[0079] Step S204: Use the target certificate to perform a handshake connection with the client. Figure 2 Step S104 of the illustrated embodiment will not be described in detail here.

[0080] The certificate matching method provided in this embodiment configures the domain name information of the certificate to fill multiple domain names into the domain name field of the certificate, thereby ensuring that the pre-configured certificate can adapt to multiple domain names, and facilitates subsequent dynamic adjustment according to the domain name corresponding to the access request. When an access request is monitored, the request domain name corresponding to the domain name parameter carried by the access request is determined, and the request domain name is matched with the domain name information in the pre-configured certificate to select multiple adapted candidate certificates, and then the target certificate is determined in combination with the attribute information possessed by the candidate certificate. In this way, dynamic matching of the target certificate according to the access request is achieved, the flexibility of certificate selection is improved, it is easy to adapt to complex security requirements, and the dynamic adjustment capability of the load balancer is improved, so that the load balancer can ensure the service quality under high concurrent requests.

[0081] In some optional implementations, the above method further includes:

[0082] Step b1, detecting the algorithm suite corresponding to the domain name parameters.

[0083] An algorithm suite is a combination of a group of encryption algorithms, which is used to support secure data transmission and authentication, etc. Specifically, an algorithm suite may include symmetric encryption algorithms (such as AES algorithm, DES algorithm, etc.), asymmetric encryption algorithms (such as RSA algorithm, ECC algorithm, etc.), etc., and the algorithm suite is not specifically limited here.

[0084] The algorithm suite corresponding to the domain name parameter is the encryption algorithm used by the requested domain name corresponding to the domain name parameter when establishing a secure connection (such as HTTPS). Specifically, an online test tool can be used to detect the algorithm suite corresponding to the domain name parameter. For example, enter the requested domain name into the online test tool, and the online test tool will automatically detect the algorithm suite used by the requested domain name. A command line tool can also be used to detect the algorithm suite corresponding to the domain name parameter. The algorithm suite can also be detected through a pre-written algorithm detection script. Of course, the algorithm suite can also be detected in other ways, which are not specifically limited here.

[0085] Step b2: Based on the detection result of the algorithm suite, determine the target certificate that matches the domain name parameters.

[0086] According to the detection result of the algorithm suite, the encryption algorithm used by the requested domain name corresponding to the domain name parameter when establishing a secure connection can be determined. According to the encryption algorithm, a target certificate using the encryption algorithm is selected from the pre-configured certificates. For example, if the encryption algorithm is the ECC algorithm, an ECC certificate is selected; if the encryption algorithm is the RSA algorithm, an RSA certificate is selected.

[0087] Specifically, if there is only one certificate in the pre-configured certificates that satisfies the encryption algorithm and supports the requested domain name, the retrieved certificate will be determined as the target certificate; if there are multiple certificates that satisfy the encryption algorithm and support the requested domain name, the multiple certificates will be selected based on the attribute information of the certificates, and the best certificate will be selected as the target certificate.

[0088] The certificate matching method provided in this embodiment detects the algorithm suite carried in the domain name parameters to select a target certificate according to the algorithm suite, thereby supporting multiple certificates and improving high-performance matching between certificates and domain names.

[0089] In some optional implementations, the method further includes: if there is no target certificate matching the domain name parameter in the multiple pre-configured certificates, determining a default certificate corresponding to the domain name parameter from the multiple pre-configured certificates.

[0090] If, after searching the domain name information of each pre-configured certificate, it is determined that there is no target certificate matching the domain name parameter, then the default certificate carrying the default mark in the pre-configured certificate is further searched, and the default certificate is used to perform a handshake connection between the client and the load balancer.

[0091] The certificate matching method provided in this embodiment supports the configuration of a default certificate. When the target certificate corresponding to the access request is not retrieved, the default certificate is selected from the pre-configured certificates for handshake connection, thereby ensuring the handshake connection between the client and the load balancer and avoiding handshake connection failure due to failure to match the target certificate.

[0092] In this embodiment, a certificate matching device is also provided, which is used to implement the above embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0093] This embodiment provides a certificate matching device, such as Figure 5 As shown, including:

[0094] The request monitoring module 301 is used to monitor the access request initiated by the client.

[0095] The request parsing module 302 is used to parse the access request and determine the domain name parameter carried in the access request.

[0096] The certificate matching module 303 is used to obtain multiple pre-configured certificates and select a target certificate that matches the domain name parameter from the multiple pre-configured certificates.

[0097] The connection module 304 is used to perform a handshake connection with the client using the target certificate.

[0098] In some optional implementations, the certificate matching module 303 includes:

[0099] The configuration unit is used to determine the domain name information corresponding to each certificate in response to the domain name configuration operation for each certificate.

[0100] The certificate generation unit is used to fill the domain name information into the domain name field of the certificate to generate a corresponding pre-configured certificate.

[0101] The parsing unit is used to parse the requested domain name corresponding to the domain name parameter, match the requested domain name with the domain name information in each pre-configured certificate, and select multiple candidate certificates corresponding to the requested domain name from multiple pre-configured certificates.

[0102] The matching unit is used to determine a target certificate matching the requested domain name from multiple candidate certificates based on the attribute information of the candidate certificates.

[0103] In some optional implementations, the matching unit includes:

[0104] The sorting subunit is used to sort multiple candidate certificates based on the attribute information of the candidate certificates to obtain a certificate sorting result.

[0105] The selection subunit is used to select a target certificate from multiple candidate certificates based on the certificate sorting result.

[0106] In some optional implementations, the attribute information includes one or more of the key length, algorithm type, and validity period. Accordingly, the sorting subunit includes:

[0107] The first sorting subunit is used to sort the candidate certificates according to the key length to obtain a first sorting result.

[0108] The second sorting subunit is used to sort the candidate certificates according to the algorithm type to obtain a second sorting result.

[0109] The third sorting subunit is used to sort the candidate certificates according to the validity period to obtain a third sorting result.

[0110] The fusion subunit is used to fuse the first sorting result, the second sorting result and the third sorting result to generate a certificate sorting result.

[0111] In some optional embodiments, the above device further includes:

[0112] The algorithm detection module is used to detect the algorithm suite corresponding to the domain name parameters.

[0113] The algorithm matching module is used to determine the target certificate that matches the domain name parameters based on the detection results of the algorithm suite.

[0114] In some optional embodiments, the above device further includes:

[0115] The default matching module is used to determine a default certificate corresponding to the domain name parameter from the multiple pre-configured certificates if there is no target certificate matching the domain name parameter in the multiple pre-configured certificates.

[0116] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0117] The certificate matching device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0118] The certificate matching device provided in this embodiment deploys multiple pre-configured certificates in the load balancer. When an access request initiated by a client is monitored, the domain name parameter of the access request is matched with the domain name information in the pre-configured certificate, the target certificate corresponding to the access request is determined from the pre-configured certificate, and the target certificate is used for handshake connection. Therefore, there is no need to set the corresponding relationship between the domain name and the certificate on the load balancer, and dynamic matching of certificates based on real-time access requests is realized, which is more adaptable to complex security requirements, improves the dynamic adjustment capability of the load balancer, and improves the processing efficiency and security of the load balancer for high concurrent requests.

[0119] The present disclosure also provides a computer device having Figure 5 The certificate shown matches the device.

[0120] See also Figure 6 , Figure 6 is a schematic diagram of a computer device provided by an optional embodiment of the present disclosure, such as Figure 6As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0121] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0122] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0123] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0124] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0125] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0126] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0127] The computer device also includes a communication interface, which is used for the computer device to communicate with other devices or a communication network.

[0128] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0129] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0130] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A certificate matching method, characterized in that: The method comprises: Monitor access requests initiated by clients; Parsing the access request to determine the domain name parameter carried in the access request; Acquire multiple pre-configured certificates, and select a target certificate that matches the domain name parameter from the multiple pre-configured certificates; A handshake connection is performed with the client using the target certificate.

2. The method according to claim 1, characterized in that The obtaining of multiple pre-configured certificates includes: In response to the domain name configuration operation for each certificate, determining the domain name information corresponding to each certificate; Fill the domain name information into the domain name field of the certificate to generate the corresponding pre-configured certificate.

3. The method according to claim 2, characterized in that The selecting a target certificate matching the domain name parameter from the multiple pre-configured certificates comprises: Parsing the requested domain name corresponding to the domain name parameter, matching the requested domain name with the domain name information in each of the pre-configured certificates, and determining multiple candidate certificates corresponding to the requested domain name from the multiple pre-configured certificates; Based on the attribute information of the candidate certificates, the target certificate matching the requested domain name is determined from the multiple candidate certificates.

4. The method according to claim 3, characterized in that The step of determining the target certificate corresponding to the domain name parameter from the multiple candidate certificates based on the attribute information of the candidate certificates includes: Sorting the multiple candidate certificates based on the attribute information of the candidate certificates to obtain a certificate sorting result; Based on the certificate sorting result, the target certificate is selected from the multiple candidate certificates.

5. The method according to claim 4, characterized in that The attribute information includes one or more of a key length, an algorithm type, and a validity period; and the sorting of the multiple candidate certificates based on the attribute information of the candidate certificates to obtain a certificate sorting result includes: Sorting the candidate certificates according to the key length to obtain a first sorting result; Sorting the candidate certificates according to the algorithm type to obtain a second sorting result; sorting the candidate certificates according to the validity periods to obtain a third sorting result; The first sorting result, the second sorting result and the third sorting result are merged to generate the certificate sorting result.

6. The method according to claim 1, characterized in that Also includes: Detecting an algorithm suite corresponding to the domain name parameters; Based on the detection result of the algorithm suite, a target certificate matching the domain name parameter is determined.

7. The method according to claim 1 or 6, characterized in that: Also includes: If there is no target certificate matching the domain name parameter in the multiple pre-configured certificates, a default certificate corresponding to the domain name parameter is determined from the multiple pre-configured certificates.

8. A certificate matching device, characterized in that: The device comprises: Request monitoring module, used to monitor access requests initiated by clients; A request parsing module, used to parse the access request and determine the domain name parameter carried in the access request; A certificate matching module, used to obtain multiple pre-configured certificates and select a target certificate that matches the domain name parameter from the multiple pre-configured certificates; A connection module is used to perform a handshake connection with the client using the target certificate.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the certificate matching method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the certificate matching method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the certificate matching method according to any one of claims 1 to 7.

Images